Is this correct - [tcpout:Forwarder_PerProduction] It seyz perPreduction - I think this is typo. ... View more

Can you install a Splunk forwarder on Elastic Search server? Then monitor the location of the logs. Just add this to /SplunkForwarderHome/etc/system/local/inputs.conf # Example of forwarder /inputs.conf [default] host = yourelastichostname # Main Logstashlogs are written to /LS_HOME/logs/[cluster_name].log [monitor:///var/log/logstash/*.log] index=logstash sourcetype=logstash # Main Elasticsearch logs are written to /ES_HOME/logs/[cluster_name].log [monitor:///var/log/elastic/*.log] index=elastic sourcetype=elastic # Folder might be called log not logs Example # /var/log/elasticsearch.log # /var/log/elasticsearch-access.log # /var/log/elasticsearch_deprecation.log Just make sure to check the location of the log - add the config. Then restart the forwarder. Profit Good luck ... View more

You need to end your "quotation marks" then max match I think max_match only works outside of the actual rex statement. Example Event1: 2016-09-22 14:14:34,029 INFO [GOONIES_CHARACTERS-V1] org.goonies.com.babyruth.logger {CHUNK_STATUS=Dead:/color1} Example Event2: 2016-09-22 14:14:34,029 INFO [GOONIES_CHARACTERS-V1] org.goonies.com.babyruth.logger {CHUNK_STATUS=Alive:/color2} Example Event3: 2016-09-22 14:14:34,029 INFO [GOONIES_CHARACTERS-V1] org.goonies.com.babyruth.logger {CHUNK_STATUS=Harm:/color3} index=CHOCOLATE GOONIES_CHARACTERS CHUNK_STATUS=* | rex "CHUNK_STATUS={(?[a-zA-Z0-9;:. /-]+)}" max_match=100 | table CHNK_STAT _raw This should put the 3 statsus in a table with the raw event next to it. Im on splunk 6.3 - hope this helped! Snoochie Boochies! ... View more

No problem. I was just being a little nit picky with documentation. =-) I already have the dashboard examples - I was looking for typical searches for users. I will build a list. Thanks! ... View more

ALL THESE LINKS ARE BROKEN! ... View more

If you need to move an index that is written inside an indexes.conf file (with other indexes also). You just need to copy the stanza out of the indexes.conf and move to the new apps location in the new indexes.conf file. Example: I will be moving an app called cloud from the "system" app and moving it to the "search" app. Edit the file below /opt/splunk/etc/system/local/indexes.conf Cut the entire stanza you want to move EXAMPLE +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ [cloud] coldPath = $SPLUNK_DB/cloud/colddb homePath = $SPLUNK_DB/cloud/db thawedPath = $SPLUNK_DB/cloud/thaweddb maxHotIdleSecs = 86400 maxHotBuckets = 10 maxDataSize = auto_high_volume frozenTimePeriodInSecs = 94608000 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Edit the file you are moving to /opt/splunk/etc/apps/search/local/indexes.conf NOTE - if no /local/indexes.conf exists - create one Paste the entire stanza from above into the new location (do not use the Plus symbols) Restart splunk Profit 😃 ... View more